In the Claims: 



Please amend the claims as follows: 

1. (currently amended) A method to increase a safety integrity level of a single safety 
controller for control of real world objects, the method comprising: 

attaching to the single safety controller a safety-hardware unit wherein the safety- 
hardware unit communicates with a central processing unit of the single safety controller, 
wherein the safety-hardware unit is used only for safety-critical control, 

connecting a bus to the single safety controller and connecting an input/output unit to the 

bus, 

downloading safety-related configuration data and/or diagnostic information to the 
attached safety-hardware unit and downloading a control function software to the single safety 
controller, 

configuring the attached safety-hardware unit to execute logic, which depends on the 
downloaded safety-related configuration data and/or diagnostic information, 

actively or passively setting output values of the single safety controller to a safe state for 
online safety control, 

obtaining access to a plurality of input and output values of a real world object through 
the bus, and 

verifying a validity of the bus communication with the attached safety hardware unit. 

2. (currently amended) The method according to claim 1, wherein the single safety 
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controller has the capability of executing a set of non-safety critical control functions, which set 
of non-safety critical control functions is the same before as well as after the safety hardware unit 
is attached. 

3. (currently amended) The method according to claim 2, wherein the configuring 
comprises: 

downloading to the attached safety hardware unit diagnostic information, which 
previously was automatically generated by a software tool as a result of user's configuration of 
the single safety controller and which diagnostic information is used in the attached safety 
hardware unit during safety critical control. 

4. (cancelled) 

5. (previously amended) The method according to claim 1, wherein the timing 
supervision of the controller is verified in the attached safety hardware unit. 

6. (previously amended) The method according to claim 1, wherein correct sequence of 
code logic is verified in the attached safety hardware unit. 

7. (previously amended) The method according to claim 1, wherein correctness of 
memory content of the controller is verified in the attached safety hardware unit. 

8. (previously amended) The method according to claim 1, wherein a download of new 
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control functionality logic to the controller is verified in the attached safety hardware unit. 

9. (previously amended) The method according to claim 1, wherein the attached safety 
hardware unit performs checks in order to allow only users logged on as safety classified 
engineers and safety classified operators to modify the control functionality logic and 
parameters. 

10. (currently amended) The method according to eteim-4 claim 1 , wherein the a bus 
communication verification logic in the attached safety hardware unit is implemented diverse. 

11. (currently amended) The method according to claim 4 claim 1 , wherein the attached 
safety hardware unit is diverse generating a safety related header for the bus communication. 

12. (previously amended) The method according to claim 11, wherein the input/output 
unit has two diverse implementations each verifying the correctness of the bus traffic and each 
generating a safety related header for the bus communication. 

13. (previously amended) The method according to claim 1, wherein the attached safety 
hardware unit comprises a first and a second module in a redundant configuration, the second 
module is updated with data that exists first module at the time of a failure and the second 
module takes over the safety related control of the control system from the first module if a 
failure of the first module is detected. 
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14. (currently amended) The method according to claim 13, wherein the a redundant 
controller unit is attached to the single safety controller, wherein the redundant controller which 
takes over in case of a failure of a primary controlle r, and wherein and the redundant controller 
unit establish establishes communication with either the active first module or the active second 
module of the attached safety hardware unit. 

15. (currently amended) A single or 1 -channel control system intended for safety-related 
control of real-world objects, comprising: 

a single main central processing unit handling main processes of a single safety 
controller, the single controller comprising a bus configured to obtain access to a plurality of 
input and output values of a real world object, the single controller further comprising a central 
processing unit, wherein the single controller is configured to download a control function 
software, and wherein the single controller is configured such that output values may be actively 
or passively set to a safe state for online safety control, 

a safety-hardware unit attached to said single safety controller, the safety-hardware unit 
comprising means to increase a safety-integrity level of the single safety controller and 
comprising means to set output values of the single safety controller in a safe state for online 
safety control , wherein the safety-hardware unit communicates with the central processing unit 
of the single controller, wherein the safety-hardware unit is used only for safety-critical control, 
herein the safety-hardware unit is configured to download safety-related configuration data 
and/or diagnostic information, wherein the safety-hardware unit is configured to execute logic 
that depends on the downloaded safety-related configuration data and/or diagnostic information, 
and wherein the safety-hardware unit is configured to verify a validity of bus communication, 
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and 

an input/output unit connected to the bus of the single controller . 

16. (currently amended) The control system according to claim 15, wherein the single 
safety controller has the capability of executing a set of non-safety critical control functions, 
which set of non- safety critical control functions is the same before as well as after the safety 
hardware unit is attached. 

17. (previously amended) The control system according to claim 16, further comprising: 
means for downloading to the attached safety hardware unit diagnostic information, 

which previously was automatically generated by a software tool as a result of user's 
configuration of the controller and which diagnostic information is used in the attached safety 
hardware unit during safety critical control. 

18. (cancelled) 

19. (currently amended) The control system according to claim 18, wherein the a bus 
communication verification logic in the attached safety hardware unit is implemented diverse. 

20. (previously amended) The control system according to claim 19, wherein the 
attached safety hardware unit is diverse generating a safety related header for the bus 
communication. 
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